Shared Responsibility Model
Learn exactly what AWS secures versus what you are responsible for, and why this distinction matters for every architecture decision.
Shared Responsibility Model is a free Cloud & IT Cert Prep lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, and your progress syncs across the web and the CoddyKit app. The Cloud & IT Cert Prep course includes 4 lessons in total.
The Shared Responsibility Model
The Shared Responsibility Model splits security in two: AWS secures the cloud itself, and you secure what you build on it. It's one of the most-tested ideas on the exam.
AWS Responsibilities: Security of the Cloud
AWS handles security of the cloud — the data centres, hardware, hypervisor, and managed-service software. You can't audit it directly, but AWS holds certifications proving it.
Customer Responsibilities: Security in the Cloud
You're responsible for security in the cloud: IAM, data encryption, OS patching, and network rules. Leave an S3 bucket public, and that's on you, not AWS.
EC2: A Customer-Heavy Example
With EC2, the line is clear: AWS runs the host and hypervisor, while you handle the OS, apps, security groups, and data. An open SSH rule is yours to fix. The code finds them.
# Check for overly permissive security groups
aws ec2 describe-security-groups \
--query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].GroupId' \
--output textManaged Services Shift Responsibility
The more managed a service, the more AWS takes on. With RDS, AWS patches the engine; with Lambda, it runs the whole runtime; with S3, it manages everything underneath.
Data Security: Always the Customer's Job
No matter the service, protecting your data is always your job. AWS gives you the tools — KMS, encryption settings — but choosing and turning them on is up to you.
Network Security Responsibilities
AWS provides the physical network, but you configure the VPC, subnets, security groups, and NACLs. Leaving port 22 open to the world is a classic, costly mistake.
Compliance and Auditing
AWS holds many compliance certifications for its infrastructure, but you must certify your own setup. Tools like Artifact, Config, and Security Hub help you do it.
Containers: Shared Responsibility Nuance
Containers add nuance. On ECS with EC2 you manage the host; with Fargate AWS does. But the container image itself is always yours to scan and keep patched.
Applying the Model to Exam Questions
On the exam, the heuristic is simple: physical or managed-service software failures are AWS's; configuration, access, data, and OS-on-IaaS failures are the customer's.
Inherited vs Shared Controls
AWS sorts controls into three kinds: inherited (fully AWS), customer-managed (fully you), and shared (both add a layer, like patching). This taxonomy shows up on the exam.
Quick Check
Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.
Lesson Recap
You learned AWS secures the infrastructure, you secure IAM, data, OS, and config, and that more managed services shift more onto AWS. Next: IAM up close.
Learn Cloud & IT Cert Prep with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 150
- Lessons
- 600
Frequently Asked Questions
Is the “Shared Responsibility Model” lesson free?
Yes — the full text of “Shared Responsibility Model” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO. The Cloud & IT Cert Prep course includes 4 lessons in total.
What will I learn in “Shared Responsibility Model”?
Learn exactly what AWS secures versus what you are responsible for, and why this distinction matters for every architecture decision. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.
How long does the “Shared Responsibility Model” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What Is Cloud Computing and AWS?
- AWS Global Infrastructure
- Core Service Categories Overview
- Shared Responsibility Model